AWS
3 posts
AWS EC2 Fundamentals — instances, security groups, pricing and networking
EC2 is AWS's flagship IaaS service. Instance types, bootstrap scripts, Security Groups, SSH access, purchasing options, IP addressing, Placement Groups and ENIs — a full rundown of the fundamentals.
AWS IAM & CLI — understanding identities, permissions and best practices
IAM is the AWS service that manages identities and permissions. Users, groups, JSON policies, roles, MFA, and the Credential Report / Last Access audit tools — everything you need to secure an AWS account.
Nimbus — SSRF to IMDS Credential Theft, YAML Deserialization RCE, and Privileged Container Escape via core_pattern
An SSRF on a job scheduler leaks AWS IAM credentials from the instance metadata service. The stolen credentials give access to an SQS queue consumed by a worker doing unsafe YAML deserialization — yielding RCE inside a container. From there, a privileged CodeBuild container built with LocalStack is used to overwrite kernel's core_pattern and escape to root on the host.